FRA9 FILE · Digital & artificial intelligence
Cybersecurity and personal data in France
Who protects systems, who regulates data and which habits matter.
See the essentials at a glance
Updated
FRA9Editorial standardsReport a correction
Reading time estimates the main text; tables, tools, references and questions take additional time.
key points: ANSSI · CNIL · RGPD · Ransomware
ANSSI, CNIL and Cybermalveillance: distinct roles
ANSSI protects central-government systems, regulates certain essential operators and publishes security frameworks. CNIL oversees personal-data processing and GDPR compliance. Cybermalveillance.gouv.fr provides information, assistance and routing for individuals, councils and businesses. A criminal complaint, technical incident report and personal-data breach notification remain separate procedures.
Reduce risk before an incident
Enable multi-factor authentication, use a password manager, patch exposed flaws promptly and remove unused accounts. Separate administrator, everyday-user and supplier access. Offline or isolated backups must be restored in a test, not merely reported as successful. The organisation should know its assets, owners, emergency contacts and services that must continue.
Phishing and payment fraud
A message can copy the identity of a director, bank, supplier or authority. Verify the request through a second, previously known channel, especially for a changed bank account, sign-in code or urgent payment. Inspect the full domain rather than the displayed name. Never approve a multi-factor prompt that you did not initiate.
The first hours of an incident
Isolate affected equipment from the network without blindly powering it off, alert the responsible team or provider and preserve logs, messages and chronology. Block compromised access and maintain critical functions. Cybermalveillance advises ransomware victims not to pay. Communicate confirmed facts and appoint one person to coordinate technical, legal and operational decisions.
Data breaches and the 72-hour rule
Any loss of confidentiality, integrity or availability of personal data must be documented. Where it creates a risk to people, the controller notifies CNIL without undue delay and, where feasible, within 72 hours of becoming aware. An initial report can be supplemented later; high risk may also require prompt communication to affected people.
Individual victim: secure, preserve, report
First change the main account password from a trusted device, revoke sessions and review recovery methods. Notify the bank or operator where payment, card or mobile service is involved. Keep URLs, headers, screenshots and statements. THESEE, Perceval, PHAROS, a police complaint and 17Cyber serve different cases, so follow the official route for the facts.
Suppliers, cloud and accountability
Outsourcing a service does not transfer all responsibility. Review contract, administrator access, location, encryption, logging, backup, onward suppliers and exit arrangements before purchase. Controller and processor should define who detects, alerts, records and notifies. Test the supplier’s emergency contact before a real incident interrupts operations.
Evidence and recovery file
Maintain a timeline of detections, decisions, affected systems, possible data, measures and communications. Preserve technical evidence without circulating sensitive information. After restoration, rotate secrets, find the entry point, monitor recurrence and repair the process rather than only the machine. The review should assign owners, deadlines and a new recovery test.
Frequently asked questions
Do ANSSI and CNIL have the same role?
No. ANSSI covers systems security; CNIL oversees personal data and GDPR compliance.
Must every breach be reported?
Every breach must be recorded; CNIL notification depends in particular on risk to people.
What is the notification deadline?
Without undue delay and, where feasible, within 72 hours of awareness of a risky breach.
Should a ransom be paid?
Cybermalveillance.gouv.fr advises against payment and recommends isolation and specialist assistance.
Is having a backup enough?
Only when it is isolated, protected and regularly proven through a real restore test.
Read next
